Application access rule for allowing Calendar permissions to a single mailbox

Question

I created an app registration in Microsoft Entra ID. The purpose is to read/write events in the calendar of an outlook shared mailbox from my NodeJS server code.

Problem is that when i add Application Permissions for Calendar to the app, I can only add them for all users. I looked at Application Access Rules but they have only Deny and Restrict rules. No 'Allow rules'.

I want to know how to restrict the app to only access that one shared mailbox and not the mailboxes of everyone else in the organization.

Thanks

Answer 1

"restrict" Is the allow.

[https://learn.microsoft.com/en-us/graph/auth-limit-mailbox-access](https://learn.microsoft.com/en-us/graph/auth-limit-mailbox-access)

Example:

New-ApplicationAccessPolicy -AccessRight RestrictAccess -AppId "e7e4dbfc-046f-4074-9b3b-2ae8f144f59b" -PolicyScopeGroupId EvenUsers@AppPolicyTest2.com -Description "Restrict this app's access to members of security group EvenUsers."

This would allow and restrict the app to just that group ( For a shared mailbox , you may need to add it to a security enabled group and scope to that group)

https://learn.microsoft.com/en-us/graph/auth-limit-mailbox-access